CVE-2026-42633: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Marcus Events Manager

This vulnerability, identified as CWE-89, is an SQL Injection in Marcus Events Manager versions up to and including 7.4.6. It arises from improper neutralization of special elements used in SQL commands within the subscriber component. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change with high confidentiality impact, no integrity impact, and low availability impact.

An attacker with low privileges can exploit this vulnerability remotely to execute arbitrary SQL commands, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the current data. Until a patch is available, restrict access to the affected component and monitor for suspicious activity related to SQL injection attempts.